US federal agencies face a deadline today, 6 November, to patch a WordPress flaw attackers are already trying to exploit, after the country's cyber agency added it to its list of actively exploited vulnerabilities. The flaw, CVE-2026-119977, affects WordPress versions 4.7 to 7.1.3 and carries a CVSS score of 8.1. The fix shipped in WordPress 7.1.4 on 28 October, with backported releases for older branches.

The weakness sits in the process that installs new versions of WordPress itself. During a full core update, WordPress unpacks the new files into a predictable folder inside wp-content/upgrade, and that copy includes the WordPress installer. An attacker with no account on the site can run code on the server during the few seconds the update runs. The flaw was reported by Umut Bayram, a researcher at Picus Security.

Attack attempts pass 240,000

Security firm Wordfence said its firewall had blocked more than 240,000 exploit attempts by 5 November, peaking at over 74,000 on 30 October. It reported that the first attempt came nine minutes after its firewall rule went live on release day. Wordfence stressed that a blocked attempt is not a break-in: a request only works during the seconds an update is running. No public report has yet described a confirmed break-in through the flaw.

Deadline binds federal agencies, but all sites are urged to patch

The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on 3 November and set 6 November as the remediation deadline for US federal civilian agencies. The order binds only those agencies, but CISA urges every organisation to prioritise listed flaws. Site owners should confirm they run 7.1.4 or their branch's backported fix, and can block web access to wp-content/upgrade, a folder WordPress itself never needs to serve.